remcos | 12ff63af0a27200b512b2fb73d0086cae611b557b4eeb3fb5b630cac9607fb7d

Analysis

max time kernel
13s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 01:49

Target

TAX DOCUMENTS 2/W2_2023.exe
Size

39KB
MD5

f1b14f71252de9ac763dbfbfbfc8c2dc
SHA1

dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
SHA256

796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
SHA512

636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
SSDEEP

768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh

Score

10^/10

Family

remcos

Botnet

RemoteHost

193.142.146.21:2404

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

W2_2023.exe

description pid process target process

PID 2764 set thread context of 4160 2764 W2_2023.exe W2_2023.exe

description	pid	process	target process
PID 2764 set thread context of 4160	2764	W2_2023.exe	W2_2023.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

W2_2023.exe

description	pid	process	target process
PID 2764 wrote to memory of 2192	2764	W2_2023.exe	cmd.exe
PID 2764 wrote to memory of 2192	2764	W2_2023.exe	cmd.exe
PID 2764 wrote to memory of 2192	2764	W2_2023.exe	cmd.exe
PID 2764 wrote to memory of 4160	2764	W2_2023.exe	W2_2023.exe
PID 2764 wrote to memory of 4160	2764	W2_2023.exe	W2_2023.exe
PID 2764 wrote to memory of 4160	2764	W2_2023.exe	W2_2023.exe
PID 2764 wrote to memory of 4160	2764	W2_2023.exe	W2_2023.exe
PID 2764 wrote to memory of 4160	2764	W2_2023.exe	W2_2023.exe

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\VIVA_01.dll",EntryPoint /f & exit
2⤵
PID:2192

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\VIVA_01.dll",EntryPoint /f
3⤵
PID:4488

C:\Users\Admin\AppData\Local\Temp\TAX DOCUMENTS 2\W2_2023.exe
"C:\Users\Admin\AppData\Local\Temp\TAX DOCUMENTS 2\W2_2023.exe"
2⤵
PID:4160

memory/2764-0-0x0000000010000000-0x0000000010F94000-memory.dmp

Filesize
15.6MB

Download
memory/2764-1-0x0000000010000000-0x0000000010F94000-memory.dmp

Filesize
15.6MB

Download
memory/2764-2-0x0000000010000000-0x0000000010F94000-memory.dmp

Filesize
15.6MB

Download
memory/2764-6-0x0000000010000000-0x0000000010F94000-memory.dmp

Filesize
15.6MB

Download
memory/4160-9-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-7-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-8-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-5-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-4-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-3-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-11-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-12-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-10-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-14-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-16-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/4160-15-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download